Contents
Judgment of the general Court (Sixth Chamber)3 December 2015note(Non-contractual liability — Petition addressed to the Parliament — Dissemination of certain personal data on the Parliament’s website — Absence of a sufficiently serious breach of a rule of law conferring rights on individuals)In Case T‑343/13,CN, residing in Brumath (France), represented by M. Velardo, lawyer,supported byEuropean Data Protection Supervisor (EDPS), represented initially by A. Buchta and V. Pozzato, then by A. Buchta, M. Pérez Asinari, F. Polverino, M. Guglielmetti and U. Kallenberger, acting as Agents,vEuropean Parliament, represented by N. Lorenz and S. Seyr, acting as Agents,THE GENERAL COURT (Sixth Chamber),composed of S. Frimodt Nielsen, President, F. Dehousse and A.M. Collins (Rapporteur), Judges,Registrar: J. Palacio González, Principal Administrator,having regard to the written part of the procedure and further to the hearing on 24 March 2015,gives the following
Judgment
Background to the dispute
1Until 2011, the applicant, CN, was an official of the Council of the European Union. On 23 September 2009, he submitted a petition to the European Parliament, on the subject of the support granted to disabled family members of a European official, the difficulties encountered by European officials suffering health problems during their careers and the mistreatment of his case by the Council, by means of a form available online on the Parliament’s website.
2On 8 January 2010, the European Commission was consulted pursuant to Rule 202(6) of the Rules of Procedure of the European Parliament (OJ 2011 L 116, p. 1, ‘the Rules of Procedure’), now Rule 216(6) of the Rules of Procedure in its version of July 2014.
3On 15 January 2010, the Committee on Petitions of the Parliament informed the applicant that his petition had been declared admissible.
4After receiving the response from the Commission on 15 March 2010, the Committee on Petitions decided to close the petition and informed the applicant accordingly on 14 June 2010.
5After rejecting the petition, the Parliament published on its website a document concerning the petition entitled ‘notice to members’ (‘the notice’). The notice provided a summary description of the content of the petition and the Commission’s response. In particular, it gave the name of the applicant and stated that he was suffering from a serious, life-threatening illness and that his son had a severe mental or physical disability.
6In May 2011, the applicant was placed on sick leave by the Council on account of his state of health.
7In April 2012, the applicant sent an email to the Commission’s ‘Europe Direct Contact Centre’, which forwarded it to the Parliament on 10 April 2012. In that email, the applicant requested that the notice be removed from the Parliament’s website.
8On 20 April 2012, the Parliament replied to the applicant, stating that it had removed the notice from the internet.
9On 31 August 2012, the applicant reiterated his request through his counsel, as, according to him, the personal data in question could still be viewed on the Parliament’s website.
10On 24 September 2012, the Parliament replied that the publication of the notice was lawful. It added that the applicant’s personal data would nevertheless be erased from the internet even though there was no legal obligation to do so.
11The Parliament has stated, in response to a written question from the Court, that the most recent erasure operations in respect of common search engines took place on 8 October 2012.
12On 4 December 2012, the applicant’s counsel reiterated the request, pointing out that the personal data in question could still be viewed on the internet.
13On 10 January 2013, the Parliament replied to the applicant’s counsel, stating that it considered its conduct to be lawful. It added that all the documents on its website had nevertheless been processed or were currently being processed in order to erase the applicant’s personal data.
14According the applicant, the personal data in question were available on the internet at least until that latter date.
Procedure and forms of order sought
15By application lodged at the Court Registry on 28 June 2013, the applicant brought the present action.
16By document lodged at the Court Registry on 4 October 2013, the European Data Protection Supervisor (EDPS) applied for leave to intervene in the present case in support of the form of order sought by the applicant. By order of 21 November 2013, the President of the Sixth Chamber granted the EDPS leave to intervene. The EDPS lodged his statement in intervention on 7 February 2014. The parties lodged their observations on that statement within the prescribed period.
17The applicant claims that the Court should:— order the European Union and the Parliament to pay a sum of EUR 1000 in compensation for material damage suffered and EUR 40000 in compensation for non-material damage suffered, plus interest calculated at the rate of 6.75%;— order the European Union and the Parliament to pay the costs.
18The Parliament contends that the Court should:— dismiss the action as unfounded;— order the applicant to pay the costs.
19On a proposal from the Judge-Rapporteur, the Court (Sixth Chamber) decided to open the oral part of the procedure and, in the context of the measures of organisation of procedure provided for in Article 64 of the Rules of Procedure of the General Court of 2 May 1991, requested the parties to lodge certain documents and put a number of questions to them in writing, requesting them to reply before the hearing. The parties complied with those requests within the prescribed time limits.
20The parties presented oral argument and replied to the oral questions put by the Court at the hearing on 24 March 2015.
Law
21In support of his action, the applicant puts forward a single plea in law, alleging the non-contractual liability of the European Union. In his view, the three conditions giving rise to such liability are met in the present case, namely that the Parliament’s conduct is unlawful, damage has been suffered, and there is a causal link between the unlawful conduct and the damage.
22The EDPS supports the applicant’s claims regarding the unlawfulness of the Parliament’s conduct.
23The Parliament claims that the action is unfounded in its entirety.
1.The unlawfulness of the Parliament’s conduct
Arguments of the parties
24As a preliminary point, the applicant asserts that, according to case-law, where unlawful conduct occurs in an area in which the institution concerned enjoys a wide discretion, the non-contractual liability of the European Union is subject to the establishment of a sufficiently serious breach of a rule of law intended to confer rights on individuals. The decisive test for finding that a breach is sufficiently serious is whether the institution manifestly and gravely disregarded the limits on its discretion.
25Conversely, according to the applicant, where an institution has only considerably reduced, or even no, discretion, the mere infringement of EU law may be sufficient to establish the existence of a sufficiently serious breach.
26The applicant asserts that, with regard to the decision to publish the notice on the Parliament’s website, the Parliament did not enjoy any discretion in view of the applicable legal framework (Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed at Rome on 4 November 1950 (ECHR), Article 8(1) of the Charter of Fundamental Rights of the European Union, Article 22 of the United Nations Convention on the Rights of Persons with Disabilities, adopted on 13 December 2006 and ratified by the European Union on 23 December 2010 (‘the Convention on the Rights of Persons with Disabilities’), and Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1)).
27The applicant submits that the Parliament infringed those provisions by publishing information on his state of health, his son’s state of health and his professional life.
28In particular, the applicant relies on Article 5(d) and Articles 10 and 16 of Regulation No 45/2001. It is not clear from the document in which he consented to public consideration of his petition that he unambiguously agreed to publication of personal data or that he expressly agreed to publication of data relating to his state of health and to the presence of a person with disabilities in his family.
29In addition, even though the applicant requested the removal of personal data from the Parliament’s website, the Parliament initially responded negatively and granted the request only following the intervention of his counsel, in contravention of the right to erasure of personal data. Furthermore, the fact that the Parliament agreed to erase the data suggests that it implicitly acknowledged the unlawfulness of the publication. Article 16 of Regulation No 45/2001 only provides for the erasure of data whose processing is unlawful.
30The Parliament’s duty of transparency cannot justify the disclosure of personal data relating to the state of health and the presence of a person with disabilities in his family. Even assuming publication of a summary of petitions in order to provide information on the activities of the EU institutions to be a legitimate interest, the infringement of the applicant’s rights is disproportionate.
31In the reply, the applicant adds that the Parliament also infringed Article 12 of the Bureau decision of 22 June 2005 on Implementing rules relating to Regulation No 45/2001 (OJ 2005 C 308, p. 1, ‘the Implementing rules relating to Regulation No 45/2001’), which provides that a request for erasure must be processed within 15 working days and that, if erasure is accepted, it must be acted upon ‘immediately’. In this case, the procedure lasted almost ten months.
32According to the applicant, Rule 203 of the Rules of Procedure neither requires nor authorises the publication of information such as that at issue. Furthermore, the Rules of Procedure, an internal organisation document, cannot derogate from Regulation No 45/2001.
33The Parliament asserts that its conduct was lawful.
34As regards the initial phase of the public consideration of the petition, the Parliament argues that its conduct was consistent with Article 5(b) (processing necessary for compliance with a legal obligation), Article 5(d) (processing based on unambiguously given consent), Article 10(2)(a) (express consent to the processing of sensitive data) and Article 10(2)(d) (processing of sensitive data which are manifestly made public by the data subject) of Regulation No 45/2001.
35First, with particular regard to the argument concerning Article 5(b) of Regulation No 45/2001, the Parliament submits that Rule 203 of the Rules of Procedure (now Rule 217) establishes as a general principle that notice is to be given of petitions. Under Rule 201(9) (now Rule 215(9)), petitions as a general rule become public documents, and the name of the petitioner and the contents of the petition may be published by the Parliament for reasons of transparency. Consequently, the submission of a petition implies, in principle, that notice is given thereof, allowing other citizens to support the signatory. In addition, the Parliament maintains that under Articles 10 and 11 TEU and Articles 15 and 232 TFEU, its work should be conducted mainly in public.
36Second, according to the Parliament, the processing of personal data was consistent with Article 5(d) of Regulation No 45/2001, since the applicant had unambiguously given his consent to the public consideration of his petition. The applicant was duly informed and did not avail himself of the option available to him to request anonymous or confidential processing of his petition.
37Third, the Parliament asserts that the consent given by the applicant in the conditions described above was express consent to the processing of sensitive data within the meaning of Article 10(2)(a) of Regulation No 45/2001.
38As regards the phase subsequent to the publication of the data, which concerns the request for erasure, the Parliament submits that the main condition for the data subject obtaining the erasure of his data on the basis of Article 16 of Regulation No 45/2001 is that the processing of the data was unlawful, which was not the case in this instance. Nevertheless, the Parliament erased the applicant’s data as a mere courtesy.
39The Parliament also maintains that Regulation No 45/2001 does not contain any rule providing for the possibility of withdrawing the consent given. If such withdrawal were possible, it could have effects only for the future. In addition, it is impossible retroactively to erase certain data, such as those in the minutes of Parliament proceedings, which are published in the Official Journal of the European Union.
40In his statement in intervention, the EDPS focuses on the condition relating to the allegedly unlawful conduct of the Parliament.
41The EDPS argues that to be valid consent must be informed and specific, that is to say, connected with a processing operation of which the individual has been informed. In the view of the EDPS, these conditions were not met in the present case. None of the information provided in the online form made clear the precise consequences of the envisaged processing to the petitioner. In particular, there was no mention in the form that sensitive data would be made accessible on the internet. The EDPS adds that Article 10(2)(a) of Regulation No 45/2001 offers additional protection to Article 5(d) of the regulation in so far as it requires that the information given to the individual with a view to obtaining his consent clearly mentions sensitive data and the envisaged processing operation. According to the EDPS, any other interpretation would deprive Article 5(d) of that regulation of its substance.
42In the light of the above considerations, the EDPS takes the view that the Parliament did not obtain the express consent of the applicant in accordance with Article 10(2)(a) of Regulation No 45/2001.
Findings of the Court
43Under the second sentence of Article 340 TFEU, ‘[i]n the case of non-contractual liability, the Union shall, in accordance with the general principles common to the laws of the Member States, make good any damage caused by its institutions or by its servants in the performance of their duties’.
44The Court has ruled that in order for the Union to incur non-contractual liability under the second sentence of Article 340 TFEU for unlawful conduct of its institutions a number of conditions must be satisfied: the institution’s conduct must be unlawful, actual damage must have been suffered and there must be a causal link between the conduct and the damage pleaded (judgments of 11 July 1997 in Oleifici Italiani v Commission, T‑267/94, ECR, EU:T:1997:113, paragraph 20, and 9 September 2008 in MyTravel v Commission, T‑212/03, ECR, EU:T:2008:315, paragraph 35). The condition of unlawful conduct of the Union’s institutions requires a sufficiently serious breach of a rule of law intended to confer rights on individuals (judgment in MyTravel v Commission, EU:T:2008:315, paragraph 37). The decisive test for finding that a breach of EU law is sufficiently serious is whether the EU institution manifestly and gravely disregarded the limits on its discretion (judgment of 5 March 1996 in Brasserie du pêcheur and Factortame, C‑46/93 and C‑48/93, ECR, EU:C:1996:79, paragraph 55).
45With regard to the condition concerning the unlawfulness of the institutions’ conduct, it must be examined, first, whether the rules of law relied on by the applicant are intended to confer rights on individuals and, second, whether the Parliament committed a sufficiently serious breach of those rules.
46In the application, the applicant relies on provisions relating to the protection of personal data contained in the Charter of Fundamental Rights, Regulation No 45/2001 and the Implementing rules relating to Regulation No 45/2001 and also on provisions relating to the protection of private life contained in the ECHR and the Convention on the Rights of Persons with Disabilities.
The rules relating to the protection of personal data
47The right to the protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights is developed by Regulation No 45/2001 in respect of acts of EU institutions and bodies and by the Implementing rules relating to Regulation No 45/2001 in respect of the Parliament in particular. These various provisions are intended to confer rights on individuals. They may therefore be relied on by the applicant in his action for compensation.
48As regards the existence of an alleged sufficiently serious breach of those rules, the arguments put forward by the applicant mainly concern the application of Regulation No 45/2001 and its Implementing rules. He does not dispute, in particular, that those rules are compatible with the right established by the Charter of Fundamental Rights. Consequently, and contrary to the claim made by the applicant, the judgment of 9 November 2010 in Volker und Markus Schecke and Eifert (C‑92/09 and C‑93/09, ECR, EU:C:2010:662) is not relevant to the outcome of these proceedings.
49Furthermore, according to case-law, it is clear from the first sentence of recital 15 of Regulation No 45/2001 that a reference to other provisions was not found necessary for processing carried out in the exercise of activities within the scope of that regulation, given that, in such cases, it is clearly Regulation No 45/2001 itself which applies (judgment of 29 June 2010 in Commission v Bavarian Lager, C‑28/08 P, ECR, EU:C:2010:378, paragraph 62). Consequently, for the purposes of the present action, it is necessary to consider the provisions of Regulation No 45/2001 and its Implementing rules.
50It has been held that the expression ‘data concerning health’ must be given a wide interpretation so as to include information concerning all aspects, both physical and mental, of the health of an individual (see, by analogy, judgment of 6 November 2003 in Lindqvist, C‑101/01, ECR, EU:C:2003:596, paragraph 50, regarding Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31)). However, that notion cannot be extended to include expressions which do not give rise to the disclosure of any data regarding a person’s health or medical condition (see, to that effect, judgment of 31 May 2005 in Dionyssopoulou v Council, T‑105/03, ECR-SC, EU:T:2005:189, paragraph 33).
51In the light of these considerations it is necessary to examine, first, the initial publication of the personal data in question and, second, the Parliament’s response to the applicant’s request to remove the data from its website.
–Dissemination of personal data on the internet
52It should be noted as a preliminary point that in this case the Parliament carried out a series of operations for the processing of personal data within the meaning of Article 2(b) of Regulation No 45/2001. Dissemination of personal data, including dissemination on the internet, constitutes such a processing operation for the purposes of that provision.
53The notice published on the Parliament’s website stated, among other things, that the applicant, who was named, had recently suffered a serious, potentially life-threatening illness and that his son had a disability. The notice also contained certain information relating to the applicant’s career.
54It must therefore be stated that the processing of data by the Parliament related to the applicant’s personal data (including information on his career) and sensitive personal data concerning the health of the applicant and of his son. The processing of these different sets of personal data should be examined separately.
55First, the processing of sensitive personal data relating to the applicant must be examined in the light of Article 10 of Regulation No 45/2001.
56Under Article 10(1) of Regulation No 45/2001, the processing of personal data revealing data concerning health is prohibited. However, Article 10(2)(a) of that regulation provides that this prohibition does not apply, inter alia, where the data subject has given his or her express consent.
57Against this background, it should be observed that Article 2(h) of Regulation No 45/2001 defines the data subject’s consent as ‘any freely given specific and informed indication of his or her wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed’.
58In this instance, it must be ascertained whether, as the Parliament claims, the applicant had given his express consent to the publication of his sensitive personal data on the internet.
59In this case, since Article 2(h) of Regulation No 45/2001 does not lay down any conditions as to form, the lodging of the petition may be regarded as an indication of the applicant’s wishes.
60In addition, the applicant does not put forward any argument to call into question the fact that the petition was freely submitted, without coercion, duress, intimidation or deception.
61Under the same provision, the consent must be specific, that is to say, connected with a processing operation (or series of processing operations) for precise purposes. That provision also stipulates that to be valid consent must be informed, which means that, when he gives his consent, the data subject has the essential information concerning the fundamental aspects of the processing, in the light of the context of the specific case.
62Lastly, it is clear from Article 10(2)(a) of Regulation No 45/2001 that where the consent relates to the processing of sensitive data, it must be express. In other words, consent must be explicit, ruling out the possibility of inferring it implicitly from the actions of the person concerned.
63The present case must be examined in the light of those considerations.
64It should be noted that the Parliament’s website recommends that petitioners read the ‘online help’ before submitting a petition. That ‘online help’ contains the following statement, under the heading ‘Publication of petitions’:‘Petitioners are advised that minutes are published in the Official Journal. Certain details, including the name of the petitioner and the number of the petition are consequently available on the Internet. This has implications for the protection of individual data and petitioners’ attention is drawn to this specifically. If, as a petitioner, you do not wish your name to be disclosed, the European Parliament will respect your privacy, but such requests must be clear and explicitly mentioned in your petition. Similarly, if you wish your petition to be treated in confidence it should also be clearly requested. The Committee attaches importance to the transparency of its meetings which may be web-streamed. Proceedings may therefore be observed on any normal computer via the EP website. Committee meetings are held in public and petitioners are able to attend if they so request, if and when their petition is discussed.’
65In addition, when he submitted his petition through the Parliament’s website, the applicant completed a form by answering the following questions in the affirmative:‘If the Committee on Petitions declares your petition admissible, do you agree to its being considered in public?’‘Do you consent to your name being recorded on a public register, accessible through Internet?’
66Account must also be taken of the following factors.
67First, the Court must take into consideration the scheme and the purpose of the right of petition to the Parliament under Articles 24 and 227 TFEU. That right of petition is expressly conceived as an instrument of democratic participation, which is intended to be transparent in order to permit other citizens to support it, if appropriate, and thus to generate a public debate. Reference should also be made to Articles 15 and 232 TFEU, which provide that the Parliament’s work should be conducted mainly in public. It is in this context that the rules governing the exercise of the right of petition, in particular those in Rule 201 et seq. of the Rules of Procedure (now Rule 215 et seq.), are intended to be applied.
68Second, reference should be made to the ordinary meaning of the expression ‘considered in public’ for an average person who is required to complete a form when he lodges his petition.
69Third, it should be noted that, at the time of submission, the applicant was informed by the Parliament that he could request anonymous or even confidential processing of his petition, that minutes were published in the Official Journal, that ‘certain details’, including the name of the petitioner, were available on the internet, that there was a public register, accessible through the internet, and that the meetings of the Committee on Petitions could be web-streamed.
70Fourth, regard should be had to the specific content of the petition at issue, namely the fact that an EU institution had purportedly failed to take due account of the applicant’s illness (and his son’s disability) for the purposes of his career, a matter which, in principle, has a degree of public interest. It should be added that the acknowledgement of receipt expressly confirmed that this was precisely the subject of the petition. Consequently, the publication of this information concerned the specific contents of the petition, and not incidental or extraneous elements.
71In this regard, Rule 201(9) of the Rules of Procedure provides that ‘[p]etitions, once registered, shall as a general rule become public documents, and the name of the petitioner and the contents of the petition may be published by Parliament for reasons of transparency’. Rule 201(10) provides that ‘[n]otwithstanding the provisions contained in paragraph 9, the petitioner may request that his or her name be withheld in order to protect his or her privacy, in which case Parliament must comply with the request’.
72Under Rule 203 of the Rules of Procedure on notice of petitions:1. Notice shall be given in Parliament of the petitions entered in the register referred to in Rule [201](6) and the main decisions on the procedure to be followed in relation to specific petitions. Such announcements shall be entered in the minutes of proceedings.2. The title and a summary of the texts of petitions entered in the register, together with the texts of the opinions and the most important decisions forwarded in connection with the examination of the petitions, shall be made available to the public in a database, provided the petitioner agrees. Confidential petitions shall be preserved in the records of Parliament, where they shall be available for inspection by Members.’
73More specifically, petitions are, in principle, public documents, even though an exception to this rule may be applied at the request of the person concerned. As the Parliament stated at the hearing, any other conclusion would effectively impose on it an obligation of censorship in relation to the contents of the petition submitted by the applicant.
74Consequently, it must be stated that in the present case, having regard to all the specific circumstances mentioned in paragraphs 64 to 73 above, the applicant provided a ‘freely given and informed indication’ of his wishes. A careful reading of the information provided by the Parliament should have enabled a reasonably observant petitioner to assess the full significance and consequences of his action. Furthermore, that indication of wishes was specific, as the Parliament informed the applicant that his complaint, the subject of which related inherently to the considerations mentioned in paragraph 70 above, would be accessible on the internet. Lastly, the applicant gave his express consent by ticking the boxes on the form relating to public consideration and recording on a register accessible on the internet, without the need for his consent to be inferred implicitly from any action.
75All these circumstances mean that this case is fundamentally different from V v Parliament (judgment of 5 July 2011 in V v Parliament, F‑46/09, ECR-SC, EU:F:2011:101, paragraph 138), in which the data subject had not given any consent to the transfer by the Commission to the Parliament of medical data concerning her.
76In the light of all the above considerations, the Court holds that in the present case the applicant had given his express consent to the disclosure of the sensitive information in question in accordance with Article 10(2)(a) of Regulation No 45/2001.
77Second, with regard to the personal data not mentioned in Article 10(1) of Regulation No 45/2001 (such as data relating to the applicant’s career), processing is subject to the rules in Article 5 of Regulation No 45/2001. Under Article 5(d) of the regulation, data may be processed, inter alia, where the data subject has unambiguously given his or her consent. In other words, data may be processed where the data subject has given his or her consent with certainty and without ambiguity.
78Whereas Article 10(2)(a) of Regulation No 45/2001 requires the consent to be express, under Article 5(d) of that regulation consent must be unambiguously given. As the EDPS has pointed out, it is logical, given the nature of sensitive personal data, that the conditions required for consent under Article 5(d) of Regulation No 45/2001 cannot be stricter than those laid down in Article 10(2)(a) of that regulation.
79Consequently, reference should be made to the statements made in paragraphs 57 to 74 above, which must be applied mutatis mutandis in the present case to the processing of personal data other than the sensitive personal data concerning the applicant. In particular, as far as the objective of the petition is concerned, it relates specifically to the fact that an EU institution had not duly taken into account the applicant’s personal situation for the purposes of his career.
80In these circumstances, the Court considers that the applicant had unambiguously provided a ‘freely given specific and informed indication’ of his wishes in relation to the processing of his personal data by the Parliament, including their disclosure in the context of the processing of a petition by the Parliament.
81As the justifications given in Article 5 of Regulation No 45/2001 for the processing of data are not cumulative, as is clear from the wording of that provision, there is no need to examine whether the processing of personal data was also justified under another of the provisions relied on by the Parliament.
82Accordingly, the Court holds that the Parliament did not commit a sufficiently serious breach of a rule of law by disseminating the personal data in question on the internet.
83Third, in so far as it states that the applicant’s son has a severe mental or physical disability, the notice also contains sensitive personal data relating to the applicant’s son, even though he is not named.
84In the absence of any indication that the applicant is the legal representative of his son, the express consent given by him cannot justify the processing of those data by the Parliament under Article 10(2)(a) of Regulation No 45/2001.
85However, the applicant’s son is not a party to the present action. Furthermore, as has just been explained, there is no evidence that the applicant is the legal representative of his son or that he has been authorised to bring the present action on his behalf.
86According to case-law, in order to ensure the effectiveness of the condition relating to the breach of a rule of law conferring rights on individuals, the protection offered by the rule invoked must be effective vis-à-vis the person who invokes it and that person must therefore be among those on whom the rule in question confers rights. A rule which does not protect the individual against the unlawfulness invoked by him, but protects another individual, cannot be accepted as a source of compensation (judgments of 12 September 2007 in Nikolaou v Commission, T‑259/03, EU:T:2007:254, paragraph 44, and 9 July 2009 in Ristic and Others v Commission, T‑238/07, EU:T:2009:263, paragraph 60). It follows that in his action for compensation the applicant cannot invoke unlawfulness resulting from the alleged breach of rights of a third party, namely his son.
–Subsequent to the request to remove the data from the website
87It must then be examined whether the Parliament’s conduct subsequent to the request to remove the applicant’s personal data from its website could constitute a sufficiently serious breach of a rule of law intended to confer rights on individuals.
88According to the applicant, when he requested the removal of personal data from the Parliament’s website, the Parliament initially responded negatively and granted the request only following the intervention of his counsel, in contravention of the right to erasure of personal data. Furthermore, the fact that the Parliament agreed to erase the data suggests that it implicitly acknowledged the unlawfulness of the publication. Lastly, the applicant adds that the Parliament infringed Article 12 of the Implementing rules relating to Regulation No 45/2001.
89In essence, the applicant’s arguments raise two questions: first, whether he had the right to the removal of his personal data and, second, whether the Parliament dealt with that request diligently.
90As regards the first question, it should be noted that Article 16 of Regulation No 45/2001 confers the right to seek the erasure of personal data only if the processing is unlawful (see, to that effect, judgment of 16 September 2009 in Vinci v ECB, F‑130/07, ECR-SC, EU:F:2009:114, paragraphs 66 and 67), as the applicant himself recognises. That provision cannot therefore be relied on in support of request for erasure where the processing is lawful, as in the present case (see paragraph 52 et seq.). The fact that the Parliament decided to grant the request does not in itself imply recognition of the unlawfulness of the initial publication. It should be noted in this regard that the Parliament has explained that it erased the data as a courtesy.
91Furthermore, under Article 18 of Regulation No 45/2001, the data subject has the right to object at any time, on compelling legitimate grounds relating to his or her particular situation, to the processing of data relating to him or her, except where, inter alia, he or she has unambiguously given his consent in accordance with Article 5(d) of that regulation.
92In addition, in so far as the processing of data in the present case was based on the consent of the data subject, it should be observed that Regulation No 45/2001 does not expressly provide for the possibility of withdrawing the consent initially given.
93In the light of the above considerations, the Court considers that the applicant was not able to invoke a right of erasure of the personal data in question on the basis of Regulation No 45/2001. It should be added that the applicant has not legitimately invoked any other ground for his request for erasure. In any event the Parliament removed the data from its website even though there was no binding obligation to do so.
94Lastly, it should be noted that Google Spain and Google (C‑131/12, ECR, EU:C:2014:317), which concerned the ‘right to be forgotten’ on the internet, related to very different factual and legal circumstances to the present case. In particular, even though in that judgment the Court held, in essence, that such a right could exist in certain conditions, the provisions of Directive 95/46 on which the Court based its reasoning (Article 7(f), Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46) differ significantly from those at issue in this case, which is connected, in essence, with the issue of the consent of the data subject. Unlike in the present case, in Google the data subject had not given his consent to the initial publication of his personal data.
95As regards the second question, the applicant has not claimed the breach of a rule or principle of law in the event that the initial publication by the Parliament was lawful, as was the case in this instance.
96It should be noted that Article 12 of the Implementing rules relating to Regulation No 45/2001, relating to the right of erasure, provides in paragraph 3:‘The data controller shall reply within 15 working days of receiving a request for erasure. If the request is accepted, it shall be acted upon immediately. If the data controller deems the request unjustified, he or she shall have 15 working days within which to inform the data subject by means of a letter stating the grounds for the decision.’
97It follows from that provision that the Parliament has 15 working days to reply to a request for erasure, whether or not it is well founded. In the present case, the applicant sent his request to the Commission’s ‘Europe Direct Contact Centre’, which forwarded it to the Parliament on 10 April 2012. The Parliament replied to the request within the prescribed time limit. Contrary to the claim made by the applicant, the Parliament never rejected the request. In actual fact, as is clear from the replies of 20 April 2012, 24 September 2012 and 10 January 2013, the Parliament agreed to erase the data, whilst rightly stating that the publication was lawful.
98The personal data were erased on around 8 October 2012, according to the Parliament, and on around 10 January 2013, according to the applicant.
99In its defence, the Parliament stated that some time was needed to track down the documents which contained the applicant’s data and to take the necessary technical measures. As the Parliament explained at the hearing in response to the Court’s questions, complete removal from the internet is a technically difficult process. The Court considers that these technical difficulties explain the time needed by the Parliament, whose technical services had to take action on several occasions, to erase the data in question and that the Parliament did not initially refuse the applicant’s request.
100Article 12(3) of the Implementing rules relating to Regulation No 45/2001 provides that if the request is accepted, it must be acted upon immediately. That provision applies to situations in which the request is accepted because it is justified, namely because the processing is unlawful. In those circumstances, it is logical that it must be acted upon immediately. However, where, as in this case, the request is not justified, but is accepted as a courtesy, there is no reason to impose an obligation to act ‘immediately’. In this case the Parliament is required only to act upon its undertaking within a reasonable period. In view of the explanations provided by the Parliament, the Court considers that in this instance it did not commit an unlawful act in the processing of the request for erasure, including in acting upon that request.
101Accordingly, the Court holds that the Parliament did not commit a sufficiently serious breach of a rule of law subsequent to the request for erasure made by the applicant.
Rules relating to the protection of private life
102With regard to the provisions relating to the protection of private life relied on by the applicant, under Article 6(3) TEU, fundamental rights, as guaranteed by the ECHR, constitute general principles of the Union’s law, even though the Union is not party to the ECHR. On the other hand, the Convention on the Rights of Persons with Disabilities has been ratified by the Union.
103However, irrespective of whether, having regard to their nature and general scheme (judgments of 23 November 1999 in Portugal v Council, C‑149/96, ECR, EU:C:1999:574, paragraph 47, and 3 February 2005 in Chiquita Brands and Others v Commission, T‑19/01, ECR, EU:T:2005:31, paragraph 114), the ECHR and the Convention on the Rights of Persons with Disabilities contain provisions intended to confer rights on individuals, it must be stated that the applicant simply claims an infringement of Article 22 of the Convention on the Rights of Persons with Disabilities without offering any specific arguments in support of that claim.
104The same holds for the alleged infringement of Article 8 of the ECHR. In this regard, the applicant merely cites three judgments of the European Court of Human Rights which, in his view, show that the right to respect for private life includes the right to keep his state of health secret (European Court of Human Rights, S. and Marper v. United Kingdom, no. 30562/04 and 30566/04, 4 December 2008) and the right to non-disclosure of data concerning professional life (European Court of Human Rights, Amann v. Switzerland, no. 27798/95, 16 February 2000, and Rotaru v. Romania, no. 28341/95, 4 May 2000). However, those judgments concern situations which are very different from the situation in the present case, specifically the storage of biometric data of persons suspected of criminal offences, the interception of a business telephone call and the creation by the public authorities of a file containing various personal information.
105Furthermore, the judgment of 5 October 1994 in X v Commission (C‑404/92 P, ECR, EU:C:1994:361), cited by the applicant in support of his claims, also concerns a very different matter, in particular the Commission’s refusal to recruit an individual who had allowed tests to be carried out which could point to possible infection with the Aids virus, despite his objection to such tests being performed. It should be stated that V v Parliament, cited in paragraph 75 above (EU:F:2011:101, paragraph 110 et seq.), also concerns a situation which is not comparable as it relates to the transfer of medical data of a former Commission employee to the Parliament without her consent, which led to the withdrawal of the offer of employment by the Parliament.
106Consequently, in the light of the above considerations, it is difficult to identify a parallelism or similarity between the facts in those cases and the present situation which could support the applicant’s arguments.
107In addition, for the reasons given in paragraph 52 et seq., ‘interference by a public authority’ in private life within the meaning of Article 8 of the ECHR cannot be considered to exist where the applicant gives his consent to the disclosure of information as in the present case.
108Consequently, the Court considers that the applicant has not established the existence of an infringement of the Convention on the Rights of Persons with Disabilities or of the ECHR by the Parliament.
109Accordingly, the arguments relating to the unlawfulness of the Parliament’s conduct must be rejected.
110As the three conditions relating to the non-contractual liability of the European Union are cumulative (judgment of 10 July 2014 in Nikolaou v Court of Auditors, C‑220/13 P, ECR, EU:C:2014:2057, paragraph 52), the action must be dismissed in its entirety, without it being necessary to examine the arguments relating to damage and the causal link. Nevertheless, the Court considers it appropriate to examine those arguments in the present case.
2.Damage and the causal link
Arguments of the parties
111The applicant asserts that the unlawful conduct of the Parliament has caused him material and non-material damage.
112First, the applicant submits that he was compelled to have recourse to the services of a legal counsel and that it was only after two letters of formal notice sent by his counsel that the Parliament removed the document from its website. The applicant thus incurred fees amounting to EUR 1000, which represents his material damage.
113Second, with regard to non-material damage, the applicant maintains that it stems from the Parliament’s dismissive and dilatory attitude, which hurt him deeply and caused him considerable stress, as he was concerned that his son, who suffers from severe mental illness and is very fragile, could become aware of the published information. He estimates the non-material damage on an equitable basis at EUR 40000.
114In the reply, the applicant claims that the time which passed between publication and the request for erasure is irrelevant. He also asserts that he submitted his request for erasure immediately, as soon as he became aware of the publication of the data.
115The applicant argues that there is a direct causal link between the unlawful conduct and the damage, as the damage is the result of the publication of the information by the Parliament and of the difficulties in obtaining the removal of the information.
116The Parliament does not dispute that if the existence of unlawful conduct were established, the applicant would have suffered material damage of EUR 1000 in respect of legal fees. However, it asserts that the applicant has not demonstrated that non-material damage exists.
117Lastly, the Parliament does not dispute the existence of a causal link if the Court were to hold that there was unlawful conduct and that the applicant has suffered damage.
Findings of the Court
118It should first be recalled that, according to case-law, with regard to the condition that damage must have been suffered, such damage must be actual and certain. By contrast, purely hypothetical and indeterminate damage does not give a right to compensation (judgment of 28 April 2010 in BST v Commission, T‑452/05, ECR, EU:T:2010:167, paragraph 165). However, the requirement relating to the existence of certain damage is met where the damage is imminent and foreseeable with sufficient certainty, even if the damage cannot yet be precisely assessed (judgment of 14 January 1987 in Zuckerfabrik Bedburg and Others v Council and Commission, 281/84, ECR, EU:C:1987:3, paragraph 14).
119It is for the party seeking to establish the European Union’s liability to adduce proof as to the existence or extent of the damage alleged and to establish a sufficiently direct causal link between that damage and the conduct complained of on the part of the institution concerned (judgment in BST v Commission, cited in paragraph 118 above, EU:T:2010:167, paragraph 167).
120The Parliament does not dispute the existence of the material damage claimed by the applicant, namely the fees for his legal counsel, if unlawful conduct were to exist.
121With regard to non-material damage, on the other hand, the applicant has not demonstrated the existence of such damage. He has merely claimed that the Parliament’s dismissive and dilatory attitude hurt him deeply and caused him considerable stress, without providing any evidence in support of this claim. Consequently, it cannot be accepted.
122Accordingly, the applicant’s arguments relating to the existence of non-material damage must be rejected.
123Lastly, the existence of a causal link is accepted where there is a direct link of cause and effect between the wrongful act of the institution concerned and the damage pleaded, in respect of which applicants bear the burden of proof (judgment of 28 September 1999 in Hautem v EIB, T‑140/97, ECR-SC, EU:T:1999:176, paragraph 85). It is settled case-law that the damage must be a sufficiently direct consequence of the conduct complained of (judgment of 25 June 1997 in Perillo v Commission, T‑7/96, ECR, EU:T:1997:94, paragraph 41).
124According to case-law, although it is not possible to prohibit those concerned from seeking legal advice at the pre-litigation stage, it is their own decision and the institution concerned cannot be held liable for the consequences (judgments of 9 March 1978 in Herpels v Commission, 54/77, ECR, EU:C:1978:45, paragraph 48; 28 June 2007 in Internationaler Hilfsfonds v Commission, C‑331/05 P, ECR, EU:C:2007:390, paragraph 24, and 8 July 2008 in Franchet and Byk v Commission, T‑48/05, ECR, EU:T:2008:257, paragraph 415). The costs thus freely incurred by the person concerned cannot therefore be imputed to the Parliament (see, to that effect, judgment in Internationaler Hilfsfonds v Commission, EU:C:2007:390, paragraph 27). Consequently, there is no causal link between the alleged material damage suffered by the applicant and the actions by the Parliament.
125The applicant’s arguments concerning the causal link between the alleged unlawful conduct and the material damage must also therefore be rejected.
126In those circumstances, the applicant’s request for compensation for damage allegedly suffered must be rejected as unfounded.
Costs
127Under Article 134(1) of the Rules of Procedure of the General Court, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the applicant has been unsuccessful, he must be ordered to pay the costs, as applied for by the Parliament.
128Under Article 138(1) of the Rules of Procedure, the EDPS must bear his own costs.
Operative part
On those grounds,THE GENERAL COURT (Sixth Chamber)hereby:
1.Dismisses the action;
2.Orders CN to pay the costs of the European Parliament and to bear his own costs;
3.Orders the European Data Protection Supervisor (EDPS) to bear his own costs.
Delivered in open court in Luxembourg on 3 December 2015.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.